Hacking Exchange From The Outside In

The talk examines Microsoft Exchange Server 2019, which uses Oracle's Outside In libraries to parse file types attached to emails. The presenter explains why this C++ SDK, which supports over 600 formats, suited memory corruption research. Fuzzer families are compared, from dumb and grammar-based tools to mutation and coverage-guided ones, before explaining the choice of AFL on Linux and Jackalope with TinyInst on Windows.

Windows fuzzing relied on GFlags page heap, which adds guard pages around allocations so overflows and use-after-free accesses fault immediately. Harness changes such as shared memory and persistent mode raised execution speed. Across three libraries, the PDF and Excel parsers yielded far more crashes than HTML, including stack overflows, heap out-of-bounds reads and flawed bounds checks. One HTML use-after-free was minimised and traced to a tree node destructor that mishandled the rightmost child.

Lab setup needed a domain controller, static addresses and mail flow rules that route attachments to the scanning process, plus raised memory limits in its configuration. Attaching a debugger to the process that loads the HTML library made crash triage possible. Reporting took months: Microsoft initially omitted credit and bounty, Oracle released a patch, and Microsoft later announced it would retire the product. The main takeaway is that legacy parsing code is under-tested and that fuzzing it is more accessible than it looks.